Privacy Policy

1. Who is responsible for personal data?

LastBot Europe Oy is the controller for personal data relating to our own website, customer and partner relationships, account administration, billing, and support.

When an organisation uses LastBot to communicate with its customers or other end users, that organisation is normally the controller of the end users’ personal data. LastBot processes that data on the organisation’s documented instructions as a processor.

2. Data we process

Depending on how the service is used, we may process:

• Account and business-contact information, such as name, business email address, role, and account details.
• Conversation information, including messages, attachments, information provided during an interaction, and support-agent notes.
• Voice transcripts created during enabled voice interactions.
• Service and security information, such as account activity, device or browser information, IP address, authentication events, and technical logs.
• Billing and contractual information where necessary to manage the customer relationship.

We do not record or retain call audio. Voice interactions are processed in real time to create transcripts and provide the service.

3. How we use personal data

We use personal data to:

• Provide, operate, secure, and support the service.
• Process and respond to conversations on behalf of our customers.
• Create transcripts for enabled voice interactions.
• Administer accounts, contracts, billing, and customer support.
• Detect, investigate, and prevent security incidents, misuse, and fraud.
• Meet legal obligations and enforce our agreements.
• Maintain and improve the reliability and security of the service.
• We do not sell personal data or use it for behavioural advertising.

4. AI processing

LastBot uses AI services to provide responses, summaries, classification, transcription, and other service functionality.

AI inputs are processed through European endpoints. AI providers process the content only to deliver the requested functionality. We configure this processing so that customer content is not retained by AI providers or used to train their models.

5. Sharing and processors

We share personal data only where necessary to provide and operate the service, including with carefully selected service providers that support hosting, communications, security, billing, and AI processing.

These providers may process data only under our instructions and appropriate contractual confidentiality and data-protection obligations. We do not permit providers to use customer content for their own purposes.

We may also disclose data where required by law or necessary to protect the rights, safety, and security of LastBot, our customers, users, or others.

6. Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, unless a longer period is required by law.

Customer-support conversation content is anonymised after 12 months of inactivity. When a conversation is anonymised, its content and personal identifiers are removed. Limited non-identifying operational information may remain for service continuity, security, billing, and aggregated reporting.

Account, contractual, billing, and security information may be retained for the duration required to manage the relationship, meet legal obligations, resolve disputes, or protect the service.

7. Website and cookies

We do not retain personal data from our marketing website for marketing profiling or behavioural advertising.

The website may use strictly necessary technical features, including cookies or similar technologies, to operate securely and reliably. These are not used for advertising profiling.

8. Legal bases

Where GDPR applies, we process personal data on the following bases:

• Performance of a contract or steps requested before entering into a contract.
• Legitimate interests, including service security, fraud prevention, service improvement, and business administration.
• Compliance with legal obligations.
• Consent, where consent is required by law.

Where LastBot acts as a processor, the customer or partner determines the lawful basis for processing end-user data.

9. Your rights

Depending on applicable law, you may have the right to:

• Access your personal data.
• Correct inaccurate or incomplete data.
• Request deletion of your data.
• Restrict or object to processing.
• Receive a portable copy of data you provided.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with a data-protection authority.

If you interacted with a business using LastBot, please contact that business first. It controls the relevant customer-service data and can handle the request directly. LastBot will assist its customers as required under applicable agreements and law.

10. Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, and disclosure. No system can be completely secure, but we continuously work to protect the confidentiality, integrity, and availability of our services.

11. Children

Our services are not directed to children. We do not knowingly collect personal data from children except where an organisation using LastBot has a lawful basis and responsibility for such processing.

12. Changes to this policy

We may update this policy when our services or legal obligations change. We will publish the updated policy on this page and revise the effective date.

13. Contact

For privacy questions or requests, contact the Chief Executive Officer of LastBot Europe Oy:

Email: privacy@lastbot.com

Address: Kimmeltie 10, 90630 Oulu, Finland